Secure communication
Transport Layer Security (TLS) is a protocol for protecting internet communications. TLS ensures that a communication is not read or changed by another entity. Blackboard Learn uses TLS to secure communications between the Web server and the client machine.
Session management
Session ID lifecycle
Each session in Blackboard Learn is protected by a cryptographically secure session identifier, stored inside a browser cookie. To help protect from session fixation attacks, the session identifier is rotated on page load, after successful login, and after logout.
Cookies
We set two simple cookie flags as an added measure against session hijacking on the session management-related cookies by default: HttpOnly and Secure.
The session_id and s_session_id cookies are used for session management. These cookies have the HttpOnly flag set. The HttpOnly flag provides an additional layer of protection from unauthorized access by potentially malicious client-side scripts. When TLS is enabled system-wide, though the session_id cookie is still present, only the s_session_id cookie is used for session management. The s_session_id has the added protection of the Secure flag. The JSESSIONID cookie is not related to session management and does not have the HttpOnly nor the Secure flag set.
Session expiration
Sessions automatically expire after a user has been idle beyond a pre-configured duration. Sessions may also be manually expired through an explicit logout.
Session fingerprinting
Session fingerprinting can help detect when a user's session has been hijacked by a malicious attacker. A fingerprint helps uniquely identify users, for example, by using their computer's IP address or the type of browser (User Agent) that they are using. Session fingerprinting is a mitigating control to reduce the risk of session hijacking by a malicious attacker.
Blackboard highly recommends enabling this control. To properly enable this control, you must select both Enable session fingerprinting and Create new session when fingerprinting changes.
Configure session fingerprinting
On the Administrator Panel, under Security, select Session Fingerprint Settings. The following table describes the available fields.
| Field | Description |
|---|---|
| Enable session fingerprinting | Select Yes to enable session fingerprinting. |
| Log Location | The location to which changes to users' fingerprints will be logged. To view the contents of the log, on the Administrator Panel, under Tools and Utilities, select Logs. |
| Fingerprint Value | Choose which values to include in the session fingerprint: IP address, User agent, or both. To minimize multiple login prompts, it is recommended to use the IP address only, since changes to the IP address should be less frequent than changes to the User Agent.
|
| Filter IP Addresses | If you select IP address or IP address and user agent in the Fingerprint Value field, select Yes to exclude ranges of IP addresses from being included in the session fingerprints. This is useful for excluding trusted IP ranges. Customize the IP ranges by modifying the bb-session-fingerprint-excluded-addresses.txt configuration file. |
| Create new session when fingerprint changes |
Select Yes to force a new session to be created when a user's fingerprint changes. For valid hijacking attempts, this will cause the hijacker to see the login page while the user maintains the current session. However, if any false positives occur (as mentioned above in the Fingerprint value section), the user will have to log in again. This is a tradeoff between security and convenience. A login prompt will appear when the multiple file applet loads when you set "Create new session when fingerprint changes" to Yes. |
